From 377514aad14ad3c5297daf14b848ef470ae56f22 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Wed, 2 Jun 2021 18:59:43 +0200 Subject: Escape filename in Content-Disposition We should escape all occurences of ' and \ in here. Signed-off-by: Lukas Reschke --- .../lib/AppFramework/Http/DownloadResponseTest.php | 36 +++++++++++++++------- 1 file changed, 25 insertions(+), 11 deletions(-) (limited to 'tests/lib/AppFramework/Http/DownloadResponseTest.php') diff --git a/tests/lib/AppFramework/Http/DownloadResponseTest.php b/tests/lib/AppFramework/Http/DownloadResponseTest.php index 6c509b8bc59..89de248cea0 100644 --- a/tests/lib/AppFramework/Http/DownloadResponseTest.php +++ b/tests/lib/AppFramework/Http/DownloadResponseTest.php @@ -30,22 +30,36 @@ class ChildDownloadResponse extends DownloadResponse { class DownloadResponseTest extends \Test\TestCase { - - /** - * @var ChildDownloadResponse - */ - protected $response; - protected function setUp(): void { parent::setUp(); - $this->response = new ChildDownloadResponse('file', 'content'); } - public function testHeaders() { - $headers = $this->response->getHeaders(); + $response = new ChildDownloadResponse('file', 'content'); + $headers = $response->getHeaders(); + + $this->assertEquals('attachment; filename="file"', $headers['Content-Disposition']); + $this->assertEquals('content', $headers['Content-Type']); + } + + /** + * @dataProvider filenameEncodingProvider + */ + public function testFilenameEncoding(string $input, string $expected) { + $response = new ChildDownloadResponse($input, 'content'); + $headers = $response->getHeaders(); + + $this->assertEquals('attachment; filename="'.$expected.'"', $headers['Content-Disposition']); + } - $this->assertStringContainsString('attachment; filename="file"', $headers['Content-Disposition']); - $this->assertStringContainsString('content', $headers['Content-Type']); + public function filenameEncodingProvider() : array { + return [ + ['TestName.txt', 'TestName.txt'], + ['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'], + ['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'], + ['A "Quoted" Filename With A Backslash \\.txt', 'A \\"Quoted\\" Filename With A Backslash \\\\.txt'], + ['A "Very" Weird Filename \ / & <> " >\'""""\.text', 'A \\"Very\\" Weird Filename \\\\ / & <> \\" >\'\\"\\"\\"\\"\\\\.text'], + ['\\\\\\\\\\\\', '\\\\\\\\\\\\\\\\\\\\\\\\'], + ]; } } -- cgit v1.2.3